Privacy Policy
Introduction
This Privacy Policy (the “Policy”) describes how Arte Collectum AB, reg. no. 559329-9356 (“Arte Collectum”, “we”, “us” or “our”), at the address Ulrikagatan 13, 115 23 Stockholm, Sweden, processes your personal data.
Arte Collectum is a Swedish portfolio manager, managing the portfolio of alternative impact investment funds investing in artworks focusing on social sustainability.
We are responsible for the processing of your personal data as described in this Policy in the capacity of data controller. If you would like to know more about our processing of your personal data, you are welcome to contact us.
It is important to us that you understand how we process your personal data. We therefore ask you to read this Policy, which we may update from time to time. If we make changes to the Policy, the new version will apply from the time it is published on our website.
2. The Scope of this Policy
The Policy covers our processing of personal data collected in relation to your interactions with us, if you are a job applicant, business partner, investor, artist, newsletter subscriber, a representative of our business partners, investors or artists, or if you are visiting our website.
3. How We Collect Your Personal Data
The personal data we process relating to you is collected directly from you or from third party data sources. If you would like to know more about the third parties from which we collect your personal data, you are welcome to contact us.
4. Legal Basis
We only process your personal data to the extent permitted by applicable data protection legislation. This means that we will only process your personal data when we have a legal basis for such processing, which in our context generally means one of the below legal bases.
Performance of a contract: the processing is necessary in order for us to provide you with our services or otherwise perform a contractual obligation between us or the company you represent, or to take actions at your request prior to entering into a contract.
Legitimate interest: the processing is necessary for the purposes of the legitimate interests pursued by us or by a third party, if they are not overridden by your interests or fundamental rights or freedoms.
Performance of a legal obligation: the processing is necessary to fulfil our legal obligations according to law or other statutes that we are subject to, or if we are subject to orders or decisions by courts or authorities, which require us to process your personal data.
Consent: the processing is carried out with your prior consent, where we are responsible for clearly informing you of what processing you consent to and your right to withdraw your consent in relation to our continued processing.
If you are acting on behalf of someone else, e.g. in the capacity of a representative of a company, our processing is carried out with reference to our legitimate interest balanced against your interests or fundamental rights or freedoms, where our legitimate interest is to conclude and perform the contract with the company you represent.
Below, we explain more about the categories of personal data we process, for what purposes we process them and what legal bases we rely on when processing your personal data, including for how long we store your personal data.
5. How We Process Your Personal Data
5.1 Business Relation
5.1.1 Purpose
The purpose is to maintain and develop our business relation with you or the company or artist you represent. We will contact and communicate with you in the role as contact person of any of our existing or potential customers, artist, partners, suppliers or business contacts in general.
5.1.2 The Personal Data Processed
• Name
• Name of investor
• Contact details, such as email address, phone number, and address
• Professional title as well as information about the company or artist you represent
• Information which you provide to us when we communicate with you
5.1.3 Legal Basis
The legal basis is our legitimate interest to engage in, maintain and develop our business relation with you or the company or artist you represent.
5.1.4 Sharing of Your Personal Data
We share your personal data with our IT-suppliers within the EU/EEA.
5.1.5 Retention Period
We process and store your personal data while we have a business relation with you or the company you represent, however for a maximum of twenty-four (24) months from the time we last were in contact because of our business relation.
5.2 Publishing Artist Information
5.2.1 Purpose
The purpose is to market, publish and describe the art and artist. This processing is carried out to inform customers, investors and business partners more about the art and the artist.
5.2.2 The Personal Data Processed
• Name of artist
• Contact details, such as email address, phone number, and address
• Professional title as well as information about the company or artist you represent
• Information in relation to the art
• Picture, video and other information concerning the artist
5.2.3 Legal Basis
The legal basis is our legitimate interest in communicating about and marketing the art and artist.
5.2.4 Sharing of Your Personal Data
We share your personal data with our IT-suppliers within the EU/EEA and publish the personal data on our website, books and other formats.
5.2.5 Retention Period
We process and store your personal data until the art is sold and up to ten (10) years thereafter.
5.3 Prevent Money Laundering and Terrorist Financing
5.3.1 Purpose
The purpose is to verify identity, satisfy our know your client obligations, perform risk analysis and measures, prevent fraud, carry out risk management and counter criminal activities, against money laundering and terrorist financing.
5.3.2 The Personal Data Processed
• Name
• Contact details, such as email address, phone number, and address
• Professional title as well as information about the company you represent
5.3.3 Legal Basis
We need to process your personal data in order to fulfil our legal obligations.
5.3.4 Sharing of Your Personal Data
We share your personal data with our IT-suppliers within the EU/EEA.
5.3.5 Retention period
We process and store your personal data while we have a business relation with you or the company you represent, however for a maximum of twenty-four (24) months from the time we last were in contact because of our business relation or as required under laws against money laundering and terrorist financing, whichever is longer.
5.4 Contracts
5.4.1 Purpose
The purpose is to enter into or fulfil contracts between us or the company or artist you represent.
5.4.2 The Personal Data Processed
• Name
• Contact details, such as email address, phone number, and address
• Professional title as well as information about the company you represent
5.4.3 Legal Basis
We need to process your personal data in order to fulfil our obligations in relation to the contract.
5.4.4 Sharing of Your Personal Data
We share your personal data with our IT-suppliers within the EU/EEA.
5.4.5 Retention Period
We process and store your personal data until the contract terminates and up to ten (10) years thereafter or for a period of time to fulfil legal obligations, for example according to the accounting act, whichever is longer.
5.5 Management of Account to Arte Collectum’s Online “Private View”
5.5.1 Purpose
The purpose is to manage your user account and to maintain and develop our relation with you or the company on whose behalf you represent.
5.5.2 The Personal Data Processed
• Name
• Contact details, such as email address, phone number, and address
• Login details
• Professional title as well as information about the company or artist you represent
5.5.3 Legal Basis
The legal basis is our legitimate interest to engage in, maintain and develop our business relation with you or the company you represent and to provide you with online viewing of the art.
5.5.4 Sharing of Your Personal Data
We share your personal data with our IT-suppliers within the EU/EEA and the provider of the online “Private View”, i.e. Artlogic in the UK and its sub processors in the US.
5.5.5 Retention Period
We keep your personal data while you have an account for our online “Private View” and for twenty-four (24) months thereafter.
5.6 Marketing and Newsletters
5.6.1 Purpose
Personal data is processed to communicate about and market our business and to manage and send newsletters or other marketing communications.
5.6.2 The Personal Data Processed
• Name
• Contact details, such as email address, phone number, and address
• Professional title as well as information about the company you represent
5.6.3 Legal Basis
The legal basis is our legitimate interest in communicating about and marketing our business, as well as managing and sending marketing communications and providing information about our business.
5.6.4 Sharing of Your Personal Data
We share your personal data with our IT-suppliers within the EU/EEA and our newsletter provider, i.e. Brevo and its sub processors in the US.
5.6.5 Retention Period
We process and store your personal data until you chose to unsubscribe. You can unsubscribe from receiving newsletters or other marketing materials at any time using the link provided in the newsletter or marketing material or by contacting us at info@artecollectum.com.
5.7 Maintain and Improve our Website
5.7.1 Purpose
The purpose is to maintain, facilitate and improve the functions and user experience of our website, as well as support our work on detecting and counteracting flaws, breaches, and incidents.
5.7.2 The Personal Data Processed
• IP-address
• Other technical information which is generated upon visiting our website, such as what type of device is used and web browser
5.7.3 Legal Basis
The legal basis is our legitimate interest to gather information to maintain, facilitate and improve the functionality and security on our website.
5.7.4 Sharing of Your Personal Data
We share your personal data with our IT-suppliers within the EU/EEA.
5.7.5 Retention Period
We process and keep information on how visitors interact with our website for a period of maximum six (6) months. In most cases, the collected personal data will be aggregated and anonymised at an earlier stage, in connection to us creating statistics.
5.8 Cookies
5.8.1 Purpose
When you visit our website, we collect information about you through cookies. Some of these cookies are always active and are necessary to provide you with a functioning website.
5.8.2 The Personal Data Processed
• IP-address
• Other technical information which is generated upon visiting our website, such as what type of device is used and web browser
5.8.3 Legal Basis
The legal basis is our legitimate interest to gather information to maintain, facilitate and improve the functionality and security on our website.
5.8.4 Sharing of Your Personal Data
We share your personal data with our IT-suppliers within the EU/EEA and the cookie suppliers as set forth in our Cookie Policy.
5.8.5 Retention Period
Please see the retention periods set forth in our Cookie Policy. In most cases, the collected personal data will be aggregated and anonymised at an earlier stage, in connection to us creating statistics.
5.9 Advertising, Performance and Analytics Cookies
5.9.1 Purpose
When you visit our website, we use marketing, performance and statistical cookies to make the website more user-friendly, to measure performance and statistics and for marketing purposes. Some marketing cookies are provided by third parties as further described in our Cookie Policy.
5.9.2 The Personal Data Processed
• IP-address
• Other technical information which is generated upon visiting our website, such as what type of device is used and web browser
• Behavioural information
5.9.3 Legal Basis
The legal basis for the processing is your consent.
5.9.4 Sharing of Your Personal Data
We share your personal data with our IT-suppliers within the EU/EEA and the cookie suppliers as set forth in our Cookie Policy.
5.9.5 Retention Period
Please see the retention periods set forth in our Cookie Policy. You may withdraw your consent at any time in the Cookie Banner or by following the instructions in our Cookie Policy. In most cases, the collected personal data will be aggregated and anonymised at an earlier stage, in connection to us creating statistics.
5.10 Recruitment
5.10.1 Purpose
The personal data processed for recruitment and employment purposes.
5.10.2 The Personal Data Processed
• Name
• Contact details, such as email address, phone number, and address
• Personal data contained in CV, personal letter, letter of recommendations, diplomas, and information provided by references
• Information provided by you during the recruitment process
5.10.3 Legal Basis
The legal basis is our legitimate interest to make it possible for us to evaluate your qualifications and personal qualities in connection with decisions on recruitment.
5.10.4 Sharing of Your Personal Data
We share your personal data with our IT-suppliers within the EU/EEA.
5.10.5 Retention Period
We need to store your personal data after you have participated in a recruitment process to protect our rights under the Swedish discrimination act. We therefore save the information from the recruitment process for two (2) years after the application process is over.
6. Security Measures
We have taken security measures to ensure that your personal data is handled in a safe way. For example, access to systems where personal data is stored is limited to our employees and service providers who require it in the course of their duties. Such parties are informed of the importance of maintaining security and confidentiality in relation to the personal data we process. We maintain appropriate safeguards and security standards to protect your personal data against unauthorised access, disclosure, or misuse. We also monitor our systems to discover vulnerabilities.
7. Further Sharing of Personal Data
For the purposes of conducting our business and complying with legal requirements and contractual obligations, we share your personal data with carefully selected recipients and the recipients mentioned above.
We will not further share your personal data with third parties except in the event:
· it is agreed between you and us,
· it is necessary to protect legitimate interests,
· it is necessary for us to fulfil a statutory obligation, comply with a public authority or court decision, or comply with legislation,
· we engage a third-party service provider or cooperation partner in order to perform services on our behalf, e.g. to provide IT- or system services, administrative services, marketing or to organise events,
· of third-party cookies used on our website, or
· it is otherwise permitted or required under applicable law.
If you wish a complete list of our recipients, please contact us at info@artecollectum.com.
We may give third parties access to your personal data, which, based on a contractual relationship with us, provides relevant services; this could be IT suppliers, our affiliates or other suppliers that process personal data for us. Such suppliers will only process personal data in accordance with our instructions according to the signed data processing agreements.
In the context of our development, the corporate structure may change, e.g. by the total or partial sale of the company. In the case of a transfer of assets containing personal data, the processing basis for the related transfer of personal data is, as a rule, based on our interest in transferring parts of our assets and making commercial or structural changes.
8. Where We Process Your Personal Data
We strive to process your personal data within the EU or EEA. However, we will transfer your personal data to service providers who, either themselves or by their sub-contractors, are located or have business activities in a country outside the EU or EEA. In such cases, we are responsible for ensuring that the transfer is made in accordance with applicable data protection legislation before it occurs, e.g. by ensuring that the country in which the recipient is located ensures an adequate level of data protection according to the European Commission, or by ensuring appropriate safeguards based on the use of standard contractual clauses that the European Commission has adopted and other appropriate measures to safeguard your rights and freedoms.
You may access a list of the countries that the European Commission has determined provide an adequate level of data protection here.
You may access the European Commission’s standard contractual clauses here.
Please contact us for more information concerning which countries outside the EU/EEA to which we currently transfer personal data.
9. Additional Retention Period
We may use personal data to handle any complaints or to defend and/or establish legal claims. We will generally process such personal data for ten (10) years from creation or for the time necessary to fulfil the purpose in the relevant case. This processing of your personal data is based on our legitimate interest of establishing and/or defending legal claims.
10. Your Rights
You have rights in relation to us and our processing of your personal data. Below, you will find information about your rights and how you can exercise them. Please note that your rights apply to the extent that follows from applicable data protection legislation and that there may be exceptions to the rights.
We also ask you to note that we may need more information from you to confirm your identity before proceeding with your request to exercise your rights.
To exercise your rights or request information about them, you are welcome to contact us.
10.1 Right of Access
You have the right to obtain a confirmation as to whether we process your personal data. If we process your personal data, you also have the right to receive copies of your personal data that we process as well as additional information about the processing, such as for what purposes the processing occurs, relevant categories of personal data and the recipients of such personal data.
10.2 Right to Rectification
You have the right to, without undue delay, have incorrect personal data about you rectified. You may also have the right to have incomplete personal data completed.
10.3 Right to Erasure
You have the right to request that we erase your personal data without undue delay in the following circumstances:
· The personal data is no longer necessary in relation to the purposes for which they were collected or otherwise processed;
· Our processing is based on your consent, and you withdraw your consent to the relevant processing;
· You object to the processing that we carry out based on a legitimate interest, and your objection overrides our or another party’s legitimate interest of the processing;
· The processed personal data is unlawfully processed;
· The processed personal data must be erased for our compliance with one or more legal obligations.
10.4 Right to Restriction
You have the right to request that we restrict the processing of your personal data in the following circumstances:
· You contest the accuracy of the personal data during a period enabling us to verify the accuracy of such data;
· The processing is unlawful, and you oppose erasure of the personal data and request restriction instead;
· The personal data is no longer needed for the purposes of the processing, but is necessary for you for the establishment, exercise or defence of legal claims;
· You have objected to the processing of the personal data which we carry out based on a legitimate interest, pending the verification whether your objection overrides our or another party’s legitimate interest to continue with the processing.
10.5 Right to Object
You have a right to object to our processing of your personal data when it is based on our or another party’s legitimate interest. If you object, we must demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms in order to be allowed to continue with our processing.
10.6 Right to Data Portability
If our processing of your personal data is based on the performance of a contract with you or your consent, you have the right to receive the personal data you have provided us relating to you in an electronic format. You also have the right to have the personal data transferred from us directly to another data controller, where technically feasible. We ask you to observe that this right to so called data portability does not cover personal data which we process manually.
10.7 Right to Withdraw Consent
If our processing of your personal data is based on your consent, you always have the right to withdraw your consent at any time. A withdrawal of your consent does not affect the lawfulness of the processing that took place based on the consent before your withdrawal.
11. Complaints with the Supervisory Authority
In Sweden, the Swedish Authority for Privacy Protection (Sw. Integritetsskyddsmyndigheten) is the authority responsible for supervising the application of current data protection legislation. If you believe that we process your personal data in a wrongful manner, we encourage you to contact us so that we can review your concerns. However, you may lodge a complaint with the Swedish Authority for Privacy Protection at any time.
12. Contact Details
If you have any questions about the processing of your personal data or want to exercise any of your rights, please contact us at:
· Mail: Ulrikagatan 13, 115 23 Stockholm, Sweden
· Email: info@artecollectum.com
· Telephone: +46 (0) 8-38 55 63